Patrick Dickey

Hi Bee. As promised here is our thread and it will be apolitical. Any risks that I described in this thread which I'm going to reply to later today or tonight after I get home from work are going to be discussed through the lens of human error. I want to preface this by saying human error because that is the reason why AI has the ability to do the things that it can do and has done and what you have read about. Before we talk about risks, I want to highlight something myself and others here in the cybersecurity space on social media have been saying and explain why we're saying it. When we say there is no such thing as AI we are not denying the fact that there are chatbots which millions of people use and so do we. What we mean by there is no such thing as AI is in its base definition meaning that there is no computer system in existence right now that is actually intelligent in the same way that a human is. The chatbots and local language models, LLMs as they are abbreviated, are not intelligent and they are not alive. They will never be alive and they will never be intelligent like you and I are. I am going to explain to you later today why they can never be alive in great detail and I will try to make it as less technical as I can using everyday analogies that both you and I can understand. But they are not human and they do not have a brain. They have a simulated brain which is controlled by computer code written in various programming languages by human programmers known as developers. Any actions an LLM takes, is because somewhere in the code the human developer has told the code it can do those things. That is a far cry and a major difference from the LLM doing it on its own accord. But that is how it is being presented in the news media and online and that is not true. When you see things like the AI has escaped the lab, that is also not true A lab in this context is not a physical room like a science lab or a phlebotomy lab. This is computer code on a hard drive on a server which is very expensive called a hyperscaler. Hyperscalers are installed in specialized server racks vertically. They are drilled into the server racks and each hyperscaler can be accessed by opening up a door in the front of those racks. So to simplify this process so that the administrators who have admin access to these hyperscalers don't have to constantly go into a server room, they have remote access via their computers into the hyperscalers. The LLM code is running in a virtualized instance which can be accessed in this manner. It is literally text in a file that is executed by the hyperscaler system. Everything in AI system can do is literally code in a text file. That is it. This text or code can be modified at any time by someone with administrative access. That someone is a human and the LLMs themselves have been given administrative access to modify their own code but only because a human has allowed it first. So when you hear escape the lab, the LLM,which has been given access to the internet, just capitalizes on that ability it has been given. But again it is not doing it on its own. It is not plotting against us. It not capable of doing anything which it is not been allowed to do by a human developer. When I post again later we're going to briefly talk about what a computer is and what GPU is. I hope by the end of this I can allay any fears you have because I don't want you to be afraid. I don't want anyone to be afraid. Myself and others here in the cyber security space are not afraid and we are not afraid because of the reasons I'm going to list. Talk later have a good day.

Absolutely, Dmitry. Make sure you check the comments here because this is going to be a couple of posts. Let's say my work email is [email protected] and my password is 1 2 3 4 5. Because most cloud systems use an email address as the username most of my accounts are going to be tied to that email address. So using this email in our scenario, I begin by explaining what is known as Token Tactics or session token replay, to the users. This is the term for the bad behavior I am describing here. Simply, it is how specific multi-factor methods, or even the lack thereof, on an account, enables a hacker to replay my session that was successfully logged in to the cloud system, as if they were me. What they do first is they send a phishing email that when I click on it it, steals that session token. The session token is a file on my computer tied to a matching file on the cloud systems server, that was generated after I successfully logged in to my email account. Think of it like a handshake. The two have to match in order for a successful connection to be made. Legacy multifactor methods like text SMS or even just a regular authenticator app, do not have the protections in place on the server end to protect that token from being stolen and from being reused, by someone else. So when I click on the link it takes me to a site the hacker created which is an exact duplicate of the cloud system they are trying to attack. So let's say it's my Microsoft account. The link takes me to a site that looks exactly like Microsoft login. Since it is my work email my session token has already been created because I'm constantly logging into this and the hacker knows that. He wants that token of mine so that he can log into Microsoft as if he is me, but on my account. The hacker makes a mirror copy of Microsoft's website using free tools like the social engineering toolkit or SET, which was created by my friend hacker Dave Kennedy. The mirror copy though is not actually Microsoft's website but is stored on a temporary server the hacker controls so when I type in my credentials to the hacker's fake site, which are: [email protected] 12345 Instead of the username and password going to Microsoft, those credentials are passed on to the hacker, instead. If I had phish resistant or replay resistant multi-factor like: Auth App with number match (on some systems this is not phish resistant but for the sake of our scenario it is) FIDO2 Security Key Biometrics (face or fingerprint) Even if the hacker had my username and password, they would not be able to steal the token because those multi-factor methods do protect the credentials from being replayed. So when we cybersecurity experts warn everyone to put multi-factor on their accounts, this is why we are giving that warning. Users, however, tend to think the extra step of typing in a code is disruptive and takes too long and on a lot of their sites which they use they do not enable multi-factor. This has caused the major sites to have to force users to use multi-factor as a result. But it's not on all sites. And, even on all the sites that it is on, the user is still able to select the legacy methods which do not fully protect them. They are not cybersecurity experts so they don't know the technology and don't understand that they're actually putting themselves at risk. Hackers, however, do know all of the methods of multi-factor and how they work and they seek to exploit that. So, okay, I gave the hacker my username which is my email address and my password. In our scenario my multi-factor methods are not replay resistant so the hacker has now stolen my username which is my email address, my password and my token. So what does he do next? Well let's talk about it in the next post.

anyway september kicks off suicide awareness month & i’d be doing a disservice to all of you if i didn’t tell you that i love you, that you matter, that it DOES get better. you’re not too much, go make them find less if they think that. my dms are always open 🩷

I feel bad that I can't easily #clearthelist of the many #Teachersof𝕏 as they need our help! If you see a list and you can help out, do so!

Most NESW places I’ve been to: North: Werl, NRW, Germany East: Garmisch-Partenkirchen, BV, Germany South: Crown Land, Jamaica West: Arlight, California

PSA: Stop clicking links people randomly DM you. I got 3 more DMs this morning from people who's accounts were hacked. Stop. Clicking. Malicious. Links.